CLOSEDQUORUM: Cisco Talos Finds the First Malware That Uses Autonomous AI to Decide Its Attacks

On September 22, Cisco Talos published the first documented analysis of malware that doesn't wait for orders from a traditional command-and-control server, but instead decides them in real time by consulting four commercial language models. Dubbed CLOSEDQUORUM, the implant puts every tactical decision to a vote among DeepSeek, Qwen, Mistral, and Gemini — with no human operator anywhere in the chain.

How it decides its attacks

CLOSEDQUORUM is a 16.4MB Windows executable compiled in Go, built to steal credentials and cryptocurrency wallets. Instead of taking instructions from an attacker-controlled domain, the implant gathers information from the compromised machine, sends it as structured context to up to four different model providers, and executes whichever action wins the vote from a fixed set of options: steal, inject, persist, or move. In case of a tie, DeepSeek gets tie-breaking priority, followed by Qwen, Mistral, and Gemini.

CAIRN, the toolkit Talos released to hunt it

Alongside the analysis, Talos released CAIRN, an open-source research toolkit built to track AI-integrated malware, using a detection approach based on the metadata of model calls rather than traditional network signatures. This is the first time a threat intelligence team of this size has released tooling specifically for this threat category.

Why this changes detection

The conceptual leap is that the malware's "orders" no longer travel as beaconing traffic to a suspicious domain — they arrive as API calls to legitimate AI providers, the same kind of traffic generated by thousands of ordinary corporate applications. That means blocking known C2 domains or IPs is no longer enough: detection has to look at behavior (which process is calling which API, how often, and for what) instead of relying on blocklists.